{"success":true,"data":{"id":"authority-title-freemail","label":"\"Support Team\" / \"IT Helpdesk\" from a free Gmail/Outlook/Yahoo account","description":"Sender display name contains an authoritative role (\"Security Team\", \"IT Helpdesk\", \"Customer Support\", \"Billing Department\", etc.) AND the sending domain is a free webmail provider (gmail.com, outlook.com, yahoo.com, icloud.com, protonmail.com, etc.). No legitimate company ever sends \"Support Team\" or \"Security Alerts\" mail from a personal gmail or outlook account — they use their corporate domain. Attackers exploit the display-name authority halo combined with the fact that free-provider SPF/DKIM genuinely passes (the email really is from gmail.com).","tier":"danger","category":"other","isThin":false}}